#So I'm more informed than the average person with my general work background (coding for physics purposes only)

[maeamian]

Weird to me that Save and Quit has become less and less of a video game industry standard, replaced with "Are you sure? All unsaved progress will be lost."

My cynical assumption for this phenomenon is that it makes the psychological barrier of quitting a bit higher thereby increasing playtime which leads to etc etc etc.

I want to be clear I have no particular insight beyond I miss save and quit, but I'm sick of going 'did I save?' to myself after having just saved and I feel like at minimum tacking on a system that suppresses that warning if there's no unsaved progress isn't an unreasonable ask.

[intersex-ionality]

I was told that TOR was mostly funded by the US fed gov't - is there any risk that they can crack it? I know it's open source, but I'm still not entirely sure what that *means* tbh. (I'm a biologist, the squishy sciences don't really teach you Python or Java, the most I can do is model population growth in Matlab. And I'm old enough that general internet security just wasn't a thing taught when I was in school.)

I mean, yeah, they can crack it by putting in a moderate level of effort, which is why the trick to using TOR effectively is to give them no reason to put in that effort. This has nothing to do with them funding its initial creation, or with it being open source. It’s simply a natural consequence of the way TOR works. Anyone can crack it, if they happen to run one of the servers that your data passes through during anonymization.

So, step one is to pair TOR with a strong, secure VPN located in a country with no extradition or security agreements with the US. This ensures that if the feds happen to catch your data as it moves through one of their servers, it’s scrambled up enough to not set off any automatic systems looking for particular keywords or patterns.

Most forms of encryption these days can be decrypted by concerted federal effort, but you first have to be worth the effort, so just… don’t be. Stay chill, don’t make yourself a desirable target, and let the fact that it costs a lot of money and manpower to crack strong encryption be your safety net.

Don’t give out personally identifiable information, such as where you live beyond a national level. If you wouldn’t feel comfortable with an overly touchy stranger at a bar knowing it, or with an abusive ex-spouse knowing it, don’t feel comfortable with the internet knowing it. No phone numbers, no addresses, no legal names.

This one is also especially tricky because lots of small, safe pieces of data can be combined into a dangerous whole. For example, I have mentioned on this website that I used to live in south Florida. I have also mentioned my family are Middle Eastern immigrants. I have also mentioned that I operate a podcast. On that podcast, I have mentioned the size of the high school I attended. On the associated twitter, I have mentioned my birth year.

With that in mind, someone dedicated enough could simply cross reference south Floridian high schools with student bodies of a particular size (a trivial detail I mentioned in one podcast), during years when I would have been high school age. Accessing those school’s yearbook archives, they could then get a list of student names. Cross-referencing those, they could identify which students are the children of immigrants, and further, which ones came from middle eastern backgrounds. Since there are only about two dozen people who meet all of those qualifiers, it then simply becomes a matter of figuring out which one is me. I’ve mentioned having grey eyes, so they could eliminate anyone with brown eyes, and that alone would probably be sufficient.

People have, in fact, done this to me in real life, using networks of minor details to find the names of myself and my family members, using it to send threats to my toddler brother or to send me pictures of google maps showing my home, etc as a way to try and get me to shut up and go along with whatever their latest fuckshow is.

And if randos online can do it, you better believe the feds can. So, just fucking lie. Keep core details of your identity the same, sure, but absolutely lie out your ASS about the minor details. Obfuscate! For example, does it matter if I lived in Miami for the sake of this particular anecdote? No? Then I should say I lived in the Florida Keys instead. Does it matter that I was 14 at the time? Then I should say I was 16 instead.

Also, don’t directly talk about committing a crime, even a very minor one, as that can be used as justification for more extreme investigation. If you wouldn’t say it in front of an angry cop or a lawyer on federal or Disney payroll, you shouldn’t say it online. 

If you pair TOR with those three major things: (1) no personally identifiable information, (2) always encrypt your data before it hits the net, (3) never admit to a crime, you’ll be safe for basically, well, anything. That’s enough security to manage moderate military intelligence, let alone whatever you as a private citizen might be doing.

Also, if your job/life/sitution will allow it, get in the habit of turning all your network devices including your phones off when you’re asleep. If your job won’t allow it, consider getting a fifteen dollar pre-paid flip phone for on-calls, work, or emergencies, buying minutes for it as needed to keep it active, and turning anything other than that flip phone off when you sleep. That way, you have an existing, regular pattern of total data blackout.

If, for example, you needed to meet up with a comrade to do some civil disobedience at some point, you could do so during your standard blackout hours, and it wouldn’t register as a change in your behavioural patterns. So the feds couldn’t use that particular day of data blackout as proof of anything other than that you were asleep.

That’s about enough security to cover the average needs. And it’s also enough security to allow you to do any further research into other, more extreme security protocols, and the potential uses for those protocols, without putting yourself at any meaningful risk.

EDIT: Also, open source just means that the source code TOR runs on is public. If you know the languages its written in, you can read it and examine it for yourself. This means the TOR project has a strong motivation for not including obvious backdoors and security leaks, because their users can and will see them.